openldap-technical April 2011

openldap-technical@openldap.org

97 participants
98 discussions

userCertificate
by Leonardo 20 Apr '11

20 Apr '11

Would i like to know if it is possible to read a certificate field directly from openldap? This certificate is stored on openldap. It attribute on OpenLDAP is userCertificate.

3 3

difficulties to stop slapd
by LALOT Dominique 20 Apr '11

20 Apr '11

Hello, Our openldap is sometimes long to stop and init scripts failed to stop. Apr 20 09:10:47 ldap1 slapd[15105]: daemon: shutdown requested and initiated. Apr 20 09:10:47 ldap1 slapd[15105]: slapd shutdown: *waiting for 0 operations/tasks to finish* Apr 20 09:*12:46 *ldap1 slapd[15105]: slapd stopped. It tooks 2 minutes to stop. So the init scrit failed and restart is not safe. An auto update on ubuntu leaves slapd in a strange state once and the cause was that long wait for 0 task to finish. Normaly, zero means immediate. Here two minutes! We have 5 glued bdb databases. Is it due to the bdb close for these databases? Is there a way to get things more reliable OpenLDAP: slapd 2.4.23 (Mar 30 2011 16:20:41) $ ^Ibuildd@crested :/build/buildd/openldap-2.4.23/debian/build/servers/slapd Description: Ubuntu 10.10 2.6.35-27-server #48-Ubuntu SMP Tue Feb 22 21:53:16 UTC 2011 x86_64 GNU/Linux libdb-4.8.so Thanks Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 1

cn=config replication to consumer / slave servers
by Christopher Strider Cook 19 Apr '11

19 Apr '11

I have a pair of mirror mode master servers that I would like to be able to provide cn=config replication to a series of slave servers, primarily, to keep ACLs in sync across servers. I've tried syncrepl to the cn=config of the primary servers trying to exclude certain objects and attributes to prevent the slave from also taking the syncprov role. This did not seem to work well enough as I was unable to prevent some unwanted entry or another from making it's way through and overwriting the syncrepl line itself. Alternately, I tried to setup a separate database cn=config_slave and have that snycrepl to the slave into cn=config... but that creates a naming missmatch. Is there an approved practice to achieve this, or some other pointers on avenues to explore? Thanks, Chris

3 8

memberof/accesslog overlays together
by Michael Ströder 19 Apr '11

19 Apr '11

HI! Unfortunately for privacy reasons I can't provide example data. I'm using slapo-memberof, slapo-refint and slapo-access in exactly this order. Now I'm analysing some strange things where modifications to group entries and the subsequent modifications by slapo-memberof are not correctly written to the accesslog DB. Questions: 1. Is this overlay order a correct setup? Should this work? Or should slapo-memberof be invoked after slapo-access? 2. CHANGES of release 2.4.24 lists a bunch of fixes to slapo-memberof. Any changes which possibly affect writing to accesslog DB? (I'm not sure whether we had problems like this with 2.4.23 or not though.) Ciao, Michael.

2 2

delta-syncrepl and N-Way Multi-Master
by Al 19 Apr '11

19 Apr '11

Hi All, I am researching implementation options, and am not 100% clear on whether delta-syncrepl and N-Way Multi-Master are compatible. Can you confirm or deny? If so, have people found success using this? Thanks in advance, Al

2 1

newbie slapd.conf VS slapd.d management ?
by Olivier 18 Apr '11

18 Apr '11

Hi everyone, SUMMARY : IN A DAY TO DAY ADMINISTRATION, SHOULD I EDIT SLAPD.CONF AND USE SLAPTEST TO TRANSLATE INTO SLAPD.D STYLE OR SHOULD I EDIT DIRECTLY FILES IN SLAPD.D AND DEFINITIVELY REMOVE THE SLAPD.CONF FILE ? IN THE FORMER CASE, IS THERE A DOCUMENTATION THAT DOESN'T MIX SLAPD.CONF WITH SLAPD.D STYLE (I'm a bit confused with examples I find to be honnest). Additional info about my question : I just start with ldap and I want to deploy an internal ldap directory that will be used for various application (authentication, information about staff in the company, etc). We are fresh, therefore we start "from scratch". I'm playing with tan openldap server 2.4 installed on a fedora. The documentation about the slapd configuration file(s) is not quite clear to me : I find information about how to configure the server by editing "slapd.conf", and at the same time this documentation says that this file is obsolete and configuration files should now now be stored in "slapd.d" directory. I have managed to edit a correct slapd.conf file and I translated it to a slapd.d style using slaptest utility : slapd is runing and I can query my directory... ok ! But could some tell me what is the PROPER way to now maintain and admininistrate an operational openldap directory : slapd.conf or slapd.d style ? THANKS FOR YOUR HELP ! --- Olivier

3 2

AD sporadically gives LDAP_SERVER_DOWN after the first request
by Markus Sander 18 Apr '11

18 Apr '11

My employer ships software for Linux and other Unix-like OSes that binds to Active Directory in order to, basically, integrate it to AD. Functionally, it is not too dissimilar to pam_krb5 and nss_ldap. OpenLDAP 2.4.18 is used to bind to Active Directory LDAP servers. Authentication (to a machine trust account) is done using a Kerberos keytab. MIT Kerberos is used. Group membership data are stored in LDAP objects of class Group which have the `member' attribute (multiply) filled with the DN of all members. Those DNs are of type Group or of type User (I'm just chasing users for now), and their `sAMAccountName' value is what I need to give to NSS as the group member's name. My procedure is as follows: First, I bind to one of several configured LDAP servers using SASL2/GSSAPI, i.e. Kerberos 5. Then I inquire all of the result set's `member' attributes and resolve the resulting DNs one by one to build a DN => sAMAccountName map in memory (that's about 10k entries, so, not a problem here). Then, I request the actual group entries and look up the DNs in the `member' attribute in the map. Last, the connection is terminated. The group members' `sAMAccountName' is inquired one by one with the base set to the DN (which I already know), the scope set to flat, and the filter set to (objectClass=*). So that's about 10k single queries in quick succession. The whole group query typically takes about 6 seconds. The problem is: OpenLDAP sometimes gives me LDAP_SERVER_DOWN during the `sAMAccountName' queries. This occurs sporadically but then typically for the rest of the `sAMAccountName' queries. The group entry query that follows does succeed. Most of the time the first of those errors immediately follows a GSSAPI error, nameley, DES key is a weak key, which may be true but appears unrelated, since only AES512, AES256 and HMAC are used in the keytab. The customer's DC admins say that the DCs are not at fault. We asked them to try to increase the server limits (such as max number of active queries per worker thread, which defaults to 4 or something), since about 2k client workstations molest 4 DCs every 30 minutes with the mentioned query (and others). They are very reluctant to do that and we have trouble replicating the problem in-house anyway, so overload need not be the root cause. The DC logs reportedly show nothing unusual. My software has been in use for about three months now, but the rollout was still on-going until lately. Customer acceptance tests did not report the problem. The first incident has been reported about two weeks ago. They set up monitoring and the bell now rings every couple of minutes somewhere. Most queries still get through without problem, though. Other queries, such as those for Netgroups, do not seem to have any problem. They also doubled the number of DCs (to four) four weeks ago, since the two they had were quite busy. The new DCs are similar in hardware but are significantly less under load, which seems odd since all four of those DCs exist just to serve our software and our software can be shown to distribute the queries fairly. Restricting our software to only the old or only the new DCs does not have any effect on the failure rate. I increased the OpenLDAP log level, but nothing enlightening turned up. What could be the cause of the failures during the group member resolution?

2 2

Configuration on Windows xp of OpenLDAP
by Mahesh Birajdar 17 Apr '11

17 Apr '11

Hi all, I am new to the OpenLDAp stuff. I want to configure OpenLDAP On windows platform and create users and administer them. Please anyone can help me.. Any Document stating how to configure and create users n administer them would be very much helpful... Thanks and Regards, MAHESH BIRAJDAR DISCLAIMER ========== This e-mail may contain privileged and confidential information which is the property of Persistent Systems Ltd. It is intended only for the use of the individual or entity to which it is addressed. If you are not the intended recipient, you are not authorized to read, retain, copy, print, distribute or use this message. If you have received this communication in error, please notify the sender and delete all copies of this message. Persistent Systems Ltd. does not accept any liability for virus infected mails.

1 0

return an attribute of all users belonging to a group
by George Mamalakis 17 Apr '11

17 Apr '11

Dear all, I have a question regarding my openldap DIT design. My design so far is based on the model: ou=people,dc=example,dc=com. It is very possible that I'll have to be able to find attributes of people belonging to some specific group (eg, student, postgrad, etc). The easiest way to address this issue for me would be to branch my DIT like this: ou=undergrads,ou=people,dc=example,dc=com and ou=postgrads,ou=people,dc=example,dc=com. On the other hand, I have several classes that I would like to distinguish my users to apart from this (like stuff, student, professors, etc.) but further sub-brunching shows to me that there's something wrong with my design (since those classes may dynamically change in the future). As a second solution I thought that it would be very easy to make my users in ou=people,dc=example,dc=com belong to some group located in ou=groups,dc=example,dc=com. This way I feel much more flexible in making such classifications, but my problem is how to formulate ldapsearch filters so as to return an attribute of some user only if the specific user belongs to one or more of my groups (for example to find all email accounts from my people that belong to the undergrads group). Thank you all for your time in advance, kind regards, George Mamalakis. PS. In the case that this is not the right place to ask questions regarding ldap programming, please address me to some related resource. The truth is that I haven't found such a place by googling, meaning that the places I've found did not seem to be maintained well. -- George Mamalakis IT Officer Electrical and Computer Engineer (Aristotle Un. of Thessaloniki), MSc (Imperial College of London) Department of Electrical and Computer Engineering Faculty of Engineering Aristotle University of Thessaloniki phone number : +30 (2310) 994379

2 2

Re: return an attribute of all users belonging to a group
by George Mamalakis 17 Apr '11

17 Apr '11

On 17/04/2011 14:03, Stefan Seelmann wrote: > Hi George, > > On Sun, Apr 17, 2011 at 12:07 PM, George Mamalakis<mamalos(a)eng.auth.gr> wrote: >> Dear all, >> >> I have a question regarding my openldap DIT design. My design so far is >> based on the model: ou=people,dc=example,dc=com. It is very possible that >> I'll have to be able to find attributes of people belonging to some specific >> group (eg, student, postgrad, etc). The easiest way to address this issue >> for me would be to branch my DIT like this: >> >> ou=undergrads,ou=people,dc=example,dc=com and >> ou=postgrads,ou=people,dc=example,dc=com. On the other hand, I have several >> classes that I would like to distinguish my users to apart from this (like >> stuff, student, professors, etc.) but further sub-brunching shows to me that >> there's something wrong with my design (since those classes may dynamically >> change in the future). >> >> As a second solution I thought that it would be very easy to make my users >> in ou=people,dc=example,dc=com belong to some group located in >> ou=groups,dc=example,dc=com. This way I feel much more flexible in making >> such classifications, but my problem is how to formulate ldapsearch filters >> so as to return an attribute of some user only if the specific user belongs >> to one or more of my groups (for example to find all email accounts from my >> people that belong to the undergrads group). > A third approach is to to store the group as attribute in the user > entries. The eduPerson schema [1] should fit your needs. Add the > eduPerson object class to your user entries and use the > eduPersonAffiliation multi-valued attribute to add the groups. > > Kind Regards, > Stefan > > [1] http://middleware.internet2.edu/eduperson/ > Stefan, thank you very much for your advise. I had already included the eduperson schema in my configuration, but I had never seen this attribute in use. I will definitely take advantage of it, now that you told me its use. Thanks again for your help, regards, George. -- George Mamalakis IT Officer Electrical and Computer Engineer (Aristotle Un. of Thessaloniki), MSc (Imperial College of London) Department of Electrical and Computer Engineering Faculty of Engineering Aristotle University of Thessaloniki phone number : +30 (2310) 994379

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical April 2011